Skip to content

Commit f8dfbf1

Browse files
bschmokerbschmoker
committed
add usage example for deception
1 parent ea4bb72 commit f8dfbf1

File tree

4 files changed

+181
-0
lines changed

4 files changed

+181
-0
lines changed

‎documentation/idioms/deception-usage/decep_consumer.py

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/usr/bin/env python
2+
# Copyright (c) 2014, The MITRE Corporation. All rights reserved.
3+
# See LICENSE.txt for complete terms.
4+
5+
import sys
6+
from stix.core import STIXPackage, STIXHeader
7+
8+
def parse_stix( pkg ):
9+
print "== INCIDENT =="
10+
for inc in pkg.incidents:
11+
for coa in inc.coa_requested:
12+
requested = coa.course_of_action
13+
print "COA: " + str(requested.title)
14+
print "Stage: "+ str(requested.stage)
15+
print "Type: "+ str(requested.type_)
16+
print "Objective: "+ str(requested.objective.description)
17+
18+
return
19+
20+
if __name__ == '__main__':
21+
try: fname = sys.argv[1]
22+
except: exit(1)
23+
fd = open(fname)
24+
stix_pkg = STIXPackage.from_xml(fd)
25+
26+
parse_stix(stix_pkg)

‎documentation/idioms/deception-usage/decep_producer.py

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/usr/bin/env python
2+
# Copyright (c) 2014, The MITRE Corporation. All rights reserved.
3+
# See LICENSE.txt for complete terms.
4+
5+
'''
6+
The following code requires python-stix v1.1.0.4 or greater installed.
7+
For installation instructions, please refer to https://github.com/STIXProject/python-stix.
8+
'''
9+
10+
def main():
11+
from stix.coa import CourseOfAction, Objective
12+
from stix.common import Confidence
13+
from stix.core import STIXPackage
14+
from stix.incident import Incident
15+
from cybox.core import Observables
16+
from cybox.objects.address_object import Address
17+
18+
from stix.common.vocabs import VocabString
19+
20+
pkg = STIXPackage()
21+
22+
incident = Incident(title="Breach of Cyber Tech Dynamics")
23+
24+
coa = CourseOfAction()
25+
coa.title = "Monitor activity related to known compromised accounts"
26+
coa.stage = VocabString("Monitor")
27+
coa.stage.xsi_type = "stixVocabs:DeceptionVocab-1.0"
28+
coa.type_ = "Redirection (Honey Pot)"
29+
30+
obj = Objective()
31+
obj.description = "This will further our investigation into the intruders who are re-using compromised accounts."
32+
33+
coa.objective = obj
34+
35+
incident.add_coa_requested(coa)
36+
37+
pkg.add_incident(incident)
38+
39+
print pkg.to_xml()
40+
41+
if __name__ == '__main__':
42+
main()

‎documentation/idioms/deception-usage/index.md

+85
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
layout: flat
3+
title: Using Deception for Defense
4+
constructs:
5+
- Incident
6+
- Course of Action
7+
summary: Leverage deception to build shared awareness of threats
8+
---
9+
10+
## Scenario
11+
Network defense teams can leverage deception to mitigate fraud and intrusions, while sharing lessons learned and effective strategies.
12+
13+
One method of referencing these actions is the "Deception Kill Chain" [described by MITRE ](http://deceptionbook.com)
14+
15+
An organization might send an Incident report describing their strategy :
16+
17+
- The Purpose of their deception: prevent intruders from unauthorized access to customer accounts
18+
- Their Collected Intelligence on intruders
19+
- Creation of a Cover Story with false identity and associated accounts
20+
- Their Plan and Preparations to link that identity to the company
21+
- Monitoring of attempts to interact with the false identity
22+
23+
## Data model
24+
To describe deception techniques, an [Incident can reference ](https://stixproject.github.io/data-model/{{site.current_version}}/indicator/IndicatorType/) one or more [Courses of Action that describe mitigation techniques](https://stixproject.github.io/data-model/{{site.current_version}}/coa/CourseOfActionType/)
25+
26+
## Implementation
27+
28+
{% include start_tabs.html tabs="XML|Python Producer|Python Consumer" name="indicator-w-kill-chain" %}{% highlight xml linenos %}
29+
30+
<stix:Incidents>
31+
<stix:Incident id="example:incident-b44bc002-4f4c-4dea-ab8b-2dbef815d016" timestamp="2015-06-02T20:21:54.139254+00:00" xsi:type='incident:IncidentType'>
32+
<incident:Title>Breach of Cyber Tech Dynamics</incident:Title>
33+
<incident:COA_Requested>
34+
<incident:Course_Of_Action id="example:coa-9b5c8e6f-c7e4-45dc-812e-098d455bf023" timestamp="2015-06-02T20:21:54.139444+00:00" xsi:type='coa:CourseOfActionType'>
35+
<coa:Title>Monitor activity related to known compromised accounts</coa:Title>
36+
<coa:Stage xsi:type="stixVocabs:DeceptionVocab-1.0">Monitor</coa:Stage>
37+
<coa:Type xsi:type="stixVocabs:CourseOfActionTypeVocab-1.0">Redirection (Honey Pot)</coa:Type>
38+
<coa:Objective>
39+
<coa:Description>This will further our investigation into the intruders who are re-using compromised accounts.</coa:Description>
40+
</coa:Objective>
41+
</incident:Course_Of_Action>
42+
</incident:COA_Requested>
43+
</stix:Incident>
44+
</stix:Incidents>
45+
46+
47+
{% endhighlight %}{% include tab_separator.html %}{% highlight python linenos %}
48+
pkg = STIXPackage()
49+
incident = Incident(title="Breach of Cyber Tech Dynamics")
50+
51+
coa = CourseOfAction()
52+
coa.title = "Monitor activity related to known compromised accounts"
53+
coa.stage = VocabString("Monitor")
54+
coa.stage.xsi_type = "stixVocabs:DeceptionVocab-1.0"
55+
coa.type_ = "Redirection (Honey Pot)"
56+
57+
obj = Objective()
58+
obj.description = "This will further our investigation into the intruders who are re-using compromised accounts."
59+
60+
coa.objective = obj
61+
62+
incident.add_coa_requested(coa)
63+
64+
pkg.add_incident(incident)
65+
66+
print pkg.to_xml()
67+
68+
{% endhighlight %}{% include tab_separator.html %}{% highlight python linenos %}
69+
70+
print "== INCIDENT =="
71+
for inc in pkg.incidents:
72+
for coa in inc.coa_requested:
73+
requested = coa.course_of_action
74+
print "COA: " + str(requested.title)
75+
print "Stage: "+ str(requested.stage)
76+
print "Type: "+ str(requested.type_)
77+
print "Objective: "+ str(requested.objective.description)
78+
79+
80+
{% endhighlight %}{% include end_tabs.html %}
81+
82+
[Full XML](sample.xml) | [Python Producer](indicator-w-kill-chain_producer.py) | [Python Consumer](indicator-w-kill-chain_consumer.py)
83+
## Further Reading
84+
85+
* [Kill Chain Definition](/data-model/{{site.current_version}}/stixCommon/KillChainType/)

‎documentation/idioms/deception-usage/sample.xml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<stix:STIX_Package
2+
xmlns:coa="http://stix.mitre.org/CourseOfAction-1"
3+
xmlns:cybox="http://cybox.mitre.org/cybox-2"
4+
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
5+
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
6+
xmlns:example="http://example.com"
7+
xmlns:incident="http://stix.mitre.org/Incident-1"
8+
xmlns:stix="http://stix.mitre.org/stix-1"
9+
xmlns:stixCommon="http://stix.mitre.org/common-1"
10+
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
11+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="example:Package-73ce966d-52d2-4092-af41-114e45721814" version="1.1.1" timestamp="2015-06-02T20:21:54.139127+00:00">
12+
<stix:Incidents>
13+
<stix:Incident id="example:incident-b44bc002-4f4c-4dea-ab8b-2dbef815d016" timestamp="2015-06-02T20:21:54.139254+00:00" xsi:type='incident:IncidentType'>
14+
<incident:Title>Breach of Cyber Tech Dynamics</incident:Title>
15+
<incident:COA_Requested>
16+
<incident:Course_Of_Action id="example:coa-9b5c8e6f-c7e4-45dc-812e-098d455bf023" timestamp="2015-06-02T20:21:54.139444+00:00" xsi:type='coa:CourseOfActionType'>
17+
<coa:Title>Monitor activity related to known compromised accounts</coa:Title>
18+
<coa:Stage xsi:type="stixVocabs:DeceptionVocab-1.0">Monitor</coa:Stage>
19+
<coa:Type xsi:type="stixVocabs:CourseOfActionTypeVocab-1.0">Redirection (Honey Pot)</coa:Type>
20+
<coa:Objective>
21+
<coa:Description>This will further our investigation into the intruders who are re-using compromised accounts.</coa:Description>
22+
</coa:Objective>
23+
</incident:Course_Of_Action>
24+
</incident:COA_Requested>
25+
</stix:Incident>
26+
</stix:Incidents>
27+
</stix:STIX_Package>
28+

0 commit comments

Comments
 (0)